Modern elevators have a large number of safety mechanisms with which faults and, in particular, hazardous situations, should be promptly and safely detected and rectified or at least mitigated. For example, they have sensors, with which the position and the velocity of an elevator car are constantly monitored.
A known generic safety system for this purpose is disclosed in WO 00/51929 A1. This safety system has a safety control unit, an elevator control unit for controlling an elevator, and at least one data bus with a plurality of bus nodes, wherein the safety control unit can receive data from the bus nodes through the data bus. The safety control unit can be operated in a plurality of different operating modes, for example in a normal operating mode, a maintenance mode, or an emergency mode. In normal operating mode, for example, on occurrence of a fault signal, a corresponding measure is initiated. For example, upon a predefined critical velocity of the elevator car being exceeded, the safety control unit shall initiate a braking of this elevator car. Alternatively, it is conceivable that, in normal operating mode, the safety control unit interrupts an operation of the elevator with open hoistway doors or car doors, except when the elevator car is exactly at the height of a floor.
If, however, a maintenance service is being performed, in which inter alia the functioning of the sensors should be verified, at least some of the actions that are controlled by the safety control unit and/or the elevator control unit must be disabled. For example, during a maintenance service, an open car door may be desirable, or even required, also in such positions of the elevator car in which it is not situated at the height of a floor. In a maintenance mode, this possibility can be provided.
To enable a maintenance mode, proposed in WO 00/51929 A1 is a maintenance switch, which can be switched on at the beginning of a maintenance service. However, this mechanism is impaired by several limitations. For example, such a maintenance switch can be relatively easily manipulated. Should an unauthorized person have access to this maintenance switch, he can switch the maintenance switch on or off, which, in either case, can endanger not only the maintenance technician.